Your details, and nothing more

When you place an order: your name, email address, phone number, delivery address (street, district, province and postal code), what you ordered and the amount paid. When you create an account: your email address and name, or the name and email address returned by Google if you sign in with Google. When you pay: your payment is processed by Omise, our payment provider. Card numbers are entered on Omise's systems and never reach ours — we receive only a transaction reference, the amount, and whether the payment succeeded. When you contact us: your name, email address and whatever you write in your message. We do not collect sensitive personal data such as health, religion, or biometric data, and we do not ask you to provide it.

To harvest, pack and deliver your order, and to give the courier the address they need. To take payment and issue refunds. To send you order confirmations and delivery updates. To answer your questions and handle quality complaints. To keep the accounting and tax records that Thai law requires of us. That is the complete list — we do not use your details for anything else, and we do not sell or rent them to anyone.

We process your order and payment details because they are necessary to perform the contract you entered into when you ordered from us. We keep order and payment records because Thai tax and accounting law obliges us to. Anything optional — marketing emails, for example — happens only if you have asked for it, and you can withdraw that consent at any time without affecting your orders.

Only the services we need to fulfil your order: Omise (payment processing), Supabase (account sign-in and our order database), Zoho Mail (order confirmation and delivery emails), our hosting provider, and the courier who carries your box, who receives your name, address and phone number and nothing else. Each of them may process your data only on our instructions. We may also disclose data where the law or a court order requires it. We do not share your data with advertisers or data brokers, now or in the future.

Order and payment records are kept for five years from the date of the order, because Thai accounting and tax law requires it. Account details are kept until you delete your account, after which they are removed within 30 days. Messages you send us are kept for 12 months. When a retention period ends, the data is deleted.

You can ask us to show you the personal data we hold about you, correct it, delete it, send you a copy in a portable format, restrict or object to how we use it, or withdraw a consent you gave. Email info@faitem.org and we will respond within 30 days, free of charge. We may need to keep order records that tax law obliges us to retain, and we will tell you if that applies. If you believe we have handled your data wrongly, you may complain to Thailand's Personal Data Protection Committee (pdpc.or.th) — but please raise it with us first, we would rather fix it.

We do not use Google Analytics, advertising pixels, or any third-party tracking, and there is nothing to opt out of. Your browser stores three things locally so the site works: your shopping cart, your language choice, and — if you sign in — your login session. They stay on your device, we cannot read them remotely, and clearing your browser storage removes them.

The site is served over HTTPS, orders are stored in an access-controlled database, and only the two people who run Faitem can see customer details. Payment card data never touches our servers — Omise, which is PCI-DSS certified, handles it. If a breach ever affects your personal data, we will notify you and the authorities as the PDPA requires.

If we change how we handle personal data, we update this page and the date at the top of it. If the change is significant — a new purpose, or a new party we share data with — we will email customers with an account before it takes effect.